"Microsoft Security Client OOBE" stopped due to error: 0xC000000D

[FloridaNative]

"Microsoft Security Client OOBE" stopped due to error: 0xC000000D

I just joined this forum today, I found it while searching for help to fix the following error as displayed in the Event Log:

When I boot up I do get my desktop, but the mouse is frozen.
I turn the power off, and back on and my system is functional.

However, I get the following error messages in the event log each time:
1. Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
2. The previous system shutdown at 6:07:45 AM on ‎1/‎26/‎2013 was unexpected.
3. The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
4. Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
5. Audit events have been dropped by the transport. 0

This has been going on for a while now. In an attempt to fix, using suggestions I found by Googling:
1. I have uninstalled Security Essentials, run a registry cleanup, re-started my system and reinstalled Security Essentials;
2. Removed the EppOobe.etl file and rebooted.
Neither of these worked.

Attached is a zip file created by running the SF_Diagnostic_Tool.exe. Prior to creating this file I followed the instructions from this page http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html in order to be able to create a complete dump file.
I have also entered as much information as possible about my system configuration into my profile.

I can do some basic fixes, but this issue has me totally stumped. Please let me know if I did anything incorrectly so far, and if you need additional information.

I would be most appreciative if a forum guru could help me fix this problem.
Thank heaps in advance!

 

[MonkeyFunkR]

After I formatted my machine I constantly had this problem and error. For a while removing the EppOobe.etl file prior to shutdown and/or rebooting was the only fix. This morning my system BSOD'd mid-game due to this bloody file/program. Not to mention MSE has been the sole cause of every issue with my machine. I've since un-installed it and installed another virus scanner all together. So far so good!

Sorry I don't have a fix for you. But I suggest downloading something else entirely.

 

[gregrocker]

This is the first report in four years I've seen of MSE malfunctioning like that, although the OOBE error does show up in logs as a minor error with a known remedy of deleting the oobe file in Program Data.

I suggest that something about your system is conflicting, so until time to reinstall I would run the other freeware recommended most here which is Avast. This solved other minor issues with one or the other in the past. This sounds more serious however.

Is this the original corrupt factory preinstall on the Dell? I would strongly consider doing what most tech enthusiasts do to Clean Reinstall - Factory OEM Windows 7.
At the minimum I'd Clean Up Factory Bloatware.

Here are other Troubleshooting Steps for Windows 7.

 

[MonkeyFunkR]

Yesterday's BSOD was the first I've had since formatting my machine back in August, which was a total system wipe. Prior to that my only issue was the system freezing. Which was the same as the OPs problem with the mouse and keyboard. Originally I thought it was a driver issue. Until I noticed that the clock wasn't changing. Upon reviewing the Event Viewer log I found that EppOobe.etl was the culprit. When I found out about removing the file my problems were gone. So long as I removed it before each shutdown and restart. And to clarify I had removed and re-installed MSE more than once.

I'm unsure why there are so many issues stemming from this .etl file. But if you google MSE error 0xC000000D you'll find numerous forums with posters experiencing the same issues as myself and the OP. All the fixes I've come across appear to be only temporary. Which is why I'm hoping uninstalling MSE and using something else solves my problem.

However, I've noticed that even with MSE uninstalled (through Control Panel) it's folder remains. After altering the folders permissions, since it wouldn't let me delete it even as an Administrator, I've managed to delete the folder. But whenever I reboot, the folder reappears and only that pesky .etl file is added. Why? How do I permanently remove this program and it's files from my machine? And yes I've run a maleware and virus scan, both of which come back clean.

As for your above post I will definitely look into the bloatware, thank you for that link!

 

[FloridaNative]

Thanks to both of you for your posts. I will try the completely remove MSE and replace with Avast later today. This is my original factory pre-installed OEM Windows. Gregrocker, thanks for the links, I will definitely see if there is any bloatware. I cleaned that off my system when I received it but more may very well have been added back in since then.

MonkeyFunkR what virus software are you using? I have had the same experience in attempting to find a solution, after a comprehensive search all of the answers appear to only be temporary fixes. I will post the results back here when done, and will definitely check to see if I have the same issue with the .etl file that you are having.

 

[MonkeyFunkR]

Through all my searching most posters recommend Avast. From what I understand it's small, not intrusive and windows friendly. But I'm unfamiliar with it.

Before using MSE (after a format) I used Comodo and had no problems. That's what I've gone back to. It's free version is anti-virus only and just a heads up when installed it will install Geekbuddy and Dragon browser. Both are extras and can be un-installed easily through control panel.

Good luck!

 

[FloridaNative]

Thank you, that is helpful, this has definitely been the most frustrating debugging I have had to do in a long time!

 

[MonkeyFunkR]

Ditto!

I installed a new graphics card a few days ago and when I saw that BSOD my heart sank. Thought I got a bad card...

If you manage to get rid of that folder and its contents let me know. Or if you come across a method to due so, please let me know. I'll do the same.

 

[gregrocker]

Nobody here recommends anything Comodo. What I see most is MSE and Avast.

Bloatware is pernicious because it can damage system files merely by its removal. That's why to shed it completely requires the Clean Reinstall - Factory OEM Windows 7.

 

[FloridaNative]

Made Some Progress, Possibly

Here is what I have done, and at the moment the message Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D is not showing in the Event Viewer when I boot up.

1. Removed MSE and did a registry cleanup.

2. Rebooted, message Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D was still in Event Viewer. Plus there was the message that when I shut down the following occurred:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-2599493413-1845634037-364224823-1001:
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\My
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\CA
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\Disallowed


3. Removed the EppOobe.etl file and rebooted.

4. Got the same dang message in the Event Viewer. But did not get the leak message.

5. I had recently installed and then uninstalled Malwarebytes so in an abundance of caution downloaded and ran their uninstaller tool to make sure the uninstall was totally clean.

6. Rebooted and got the leak message and that same dang message yet again.

7. Loaded Avast, that went fine.

8. Went to How to manually uninstall Microsoft Security Essentials 2.0.1963 if you cannot uninstall it by using the Add or Remove Programs item and first downloaded and ran the FixIt Wizard. No luck on reboot.

9. Went back to How to manually uninstall Microsoft Security Essentials 2.0.1963 if you cannot uninstall it by using the Add or Remove Programs item and went through their step by step process of removing MSE, but found none of the files indicated in the process. Removed the EppOobe.etl file one more time, and upon reboot EUREKA, the Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D did not show up in the Event Viewer. What did show was the Leak message again as follows:

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-2599493413-1845634037-364224823-1001:
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\My
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\CA
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\Disallowed

Some websites say ignore this message, other say it should be investigated. I still have the Microsoft Security Client Folder/Support/and multiple files underneath. And DANGIT the wretched EppOobe.etl is back.

I am taking a break, and will be out all day tomorrow. Are these leak messages helpful, is there something else I can try based on this information?

Thank you!

 

[gregrocker]

Did you delete the MSE Programs file again?

 

[MonkeyFunkR]

Did you delete the MSE Programs file again?

The folder and EppOobe.etl file re-appear after a reboot...

 

[FloridaNative]

I just did two new reboots, after checking to make sure that the EppOobe.etl file was not in the Microsoft Security Essentials/Support folder. The original error did not re-appear, nor has that file reappeared. I have not removed the folder Microsoft Security Essentials or any of the other files inside of the Support folder under this folder.
Should I remove the entire folder by a simple delete, I know of no other way to remove it.
Also, I just paid more attention to the two folders next to the MSE folder, Microsoft Antimalware - which has multiple, almost empty - but not quite, folders underneath, and Microsoft Security Client, which has a Support folder and an identically name EppOobe.etl file in it. No clue as to how similar this is to the one in the MSE folder.
The operative question is should both of these folders and their contents also be removed in order to have a completely clean uninstall? They are not available through the Program Manager Programs Uninstall feature.
MFR, do you also have these folders? Is it safe to just delete them?
Thanks!

 

[gregrocker]

You uninstalled MSE, correct? Then why are you asking if it's OK to delete the MSE programs folder after I just told you to delete it?

 

[FloridaNative]

Yes, I uninstalled MSE. Since the initial reference was to an MSE program file, not a folder, I wanted to double check to be 100% certain is was ok to remove the entire folder.
I have deleted it, thank you, and done a reboot.
The Events Viewer had zero entries, and the MSE folder did not reappear.
I will track this to ensure that this fix continues to work.
I assume the Antimalware and Security Client folders should be ignored for now?
I must be off, will sign back in tomorrow afternoon with any new status updates.
Thanks again for all the help, hope this is the fix!

 

[gregrocker]

You owe it to yourself as someone who is tech oriented to do what most tech enthusiasts do and Clean Reinstall - Factory OEM Windows 7 to shed the bloatware and enjoy Win7 in its native perfect state.

There is just no comparison how much better it is, plus you learn so much!

 

[indianacarnie]

 

[FloridaNative]

It has been a while since I posted, but I do finally have a resolution to the problem.
I was able to completely removed MSE, by first removing it through the Programs and Features interface, then by going into Explorer and removing the folders that remained, and finally cleaning out all the remaining entries in the Registry following the instructions listed here How to manually uninstall Microsoft Security Essentials 2.0.1963 if you cannot uninstall it by using the Add or Remove Programs item.
However, a few days later I started getting entirely different errors and issues when I booted up.
At this point I had a hardware specialist run diagnostics and he determined that the motherboard was going bad, and in a three year old machine, to replace it would require replacing the processor so we were getting into some real cost issues.
For me it is more economical to have a new custom (and much faster) machine built by a talented local technician. The new machine (parts just ordered from NewEgg) will have the Intel Core i7-3770K Ivy Bridge processor, 16GB of RAM, 2-1TB hard drives, the ASRock B75M-DGS LGA 1155 Intel B75 SATA 6Gb/s USB 3.0 Micro ATX Intel Motherboard, a Sapphire Radeon HD 7770 Video Card, and yes, a squeaky clean, no bloatware copy of Windows 7 Home Premium.
Thank you again for your help, and I hope this post can help others.

 

[Jacee]

In the future, if anyone is still running MSE v.2 .... It should have been updated to version 4. This was available Client Update Package - Kb2691906.

Download Microsoft Security Essentials from Official Microsoft Download Center

http://support.microsoft.com/kb/2691906

 

[Layback Bear]

FloridaNative if you could sneak a SSD in there and use the other drive for storage you would be forever happy.